Analysis
-
max time kernel
188s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 05:10
Static task
static1
General
-
Target
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe
-
Size
595KB
-
MD5
414f4a3b05028be19e006ae2ba9182b6
-
SHA1
2a66efff8a0dfcf8d0ac247940b8f790c3c9d377
-
SHA256
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec
-
SHA512
82491b4e7876aa3d4306f1fdde6838e93fa123e0b66df8e262275be3fc5b80565475651bcc39765240467b209ca099522afa602ec414ebd9ee5bcaa8dc8a9a44
-
SSDEEP
12288:Ongh/PsZ1DX/VDJ8rrvE4kynl6i6rJ49j9qkaxv:Ongh/PVU4kYqJK9qkC
Malware Config
Extracted
remcos
1.7 Pro
Nov 24th
gcrozona.duckdns.org:6062
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
Microsoft Intel Audios.exe
-
copy_folder
Audio Microsoft File
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%WinDir%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Windows Display
-
keylog_path
%WinDir%
-
mouse_option
false
-
mutex
Windows Audio
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
Window Security Check
-
take_screenshot_option
true
-
take_screenshot_time
5
-
take_screenshot_title
Username;password;proforma;invoice;notepad
Signatures
-
Processes:
reg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
Processes:
Microsoft Intel Audios.exeMicrosoft Intel Audios.exeMicrosoft Intel Audios.exepid process 2436 Microsoft Intel Audios.exe 1596 Microsoft Intel Audios.exe 4144 Microsoft Intel Audios.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exeMicrosoft Intel Audios.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run\ c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Window Security Check = "\"C:\\Windows\\Audio Microsoft File\\Microsoft Intel Audios.exe\"" c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Microsoft Intel Audios.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Window Security Check = "\"C:\\Windows\\Audio Microsoft File\\Microsoft Intel Audios.exe\"" Microsoft Intel Audios.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exeMicrosoft Intel Audios.exedescription pid process target process PID 3028 set thread context of 4672 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 2436 set thread context of 4144 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe -
Drops file in Windows directory 3 IoCs
Processes:
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exedescription ioc process File created C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe File opened for modification C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe File opened for modification C:\Windows\Audio Microsoft File c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exeMicrosoft Intel Audios.exepid process 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe 2436 Microsoft Intel Audios.exe 2436 Microsoft Intel Audios.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exeMicrosoft Intel Audios.exedescription pid process Token: SeDebugPrivilege 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe Token: SeDebugPrivilege 2436 Microsoft Intel Audios.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exec09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.execmd.execmd.exeMicrosoft Intel Audios.exeMicrosoft Intel Audios.execmd.exedescription pid process target process PID 3028 wrote to memory of 3236 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 3028 wrote to memory of 3236 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 3028 wrote to memory of 3236 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 3028 wrote to memory of 4672 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 3028 wrote to memory of 4672 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 3028 wrote to memory of 4672 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 3028 wrote to memory of 4672 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 3028 wrote to memory of 4672 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 3028 wrote to memory of 4672 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 3028 wrote to memory of 4672 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 3028 wrote to memory of 4672 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 3028 wrote to memory of 4672 3028 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe PID 4672 wrote to memory of 2096 4672 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe cmd.exe PID 4672 wrote to memory of 2096 4672 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe cmd.exe PID 4672 wrote to memory of 2096 4672 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe cmd.exe PID 2096 wrote to memory of 4288 2096 cmd.exe reg.exe PID 2096 wrote to memory of 4288 2096 cmd.exe reg.exe PID 2096 wrote to memory of 4288 2096 cmd.exe reg.exe PID 4672 wrote to memory of 4364 4672 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe cmd.exe PID 4672 wrote to memory of 4364 4672 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe cmd.exe PID 4672 wrote to memory of 4364 4672 c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe cmd.exe PID 4364 wrote to memory of 892 4364 cmd.exe PING.EXE PID 4364 wrote to memory of 892 4364 cmd.exe PING.EXE PID 4364 wrote to memory of 892 4364 cmd.exe PING.EXE PID 4364 wrote to memory of 2436 4364 cmd.exe Microsoft Intel Audios.exe PID 4364 wrote to memory of 2436 4364 cmd.exe Microsoft Intel Audios.exe PID 4364 wrote to memory of 2436 4364 cmd.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 1596 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 1596 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 1596 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 4144 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 4144 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 4144 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 4144 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 4144 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 4144 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 4144 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 4144 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 2436 wrote to memory of 4144 2436 Microsoft Intel Audios.exe Microsoft Intel Audios.exe PID 4144 wrote to memory of 4396 4144 Microsoft Intel Audios.exe cmd.exe PID 4144 wrote to memory of 4396 4144 Microsoft Intel Audios.exe cmd.exe PID 4144 wrote to memory of 4396 4144 Microsoft Intel Audios.exe cmd.exe PID 4396 wrote to memory of 3964 4396 cmd.exe reg.exe PID 4396 wrote to memory of 3964 4396 cmd.exe reg.exe PID 4396 wrote to memory of 3964 4396 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe"C:\Users\Admin\AppData\Local\Temp\c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe"C:\Users\Admin\AppData\Local\Temp\c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe"C:\Users\Admin\AppData\Local\Temp\c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
-
C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe"C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe"C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe"5⤵
- Executes dropped EXE
-
C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe"C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- UAC bypass
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.batFilesize
109B
MD58ddcdd0ab01b0740982e7b78b1591015
SHA1acbb9c4bb32822a164f200f8b77eda0ce7bd758d
SHA2567c1abbf1a20f581d2db76d769cc14cf753a412cf92e383a36ffbf0c962eaf678
SHA512ef43e3cb89c800529530183d4315782a864281ef8a0e6443a54ccc4f1837fcbfe43027b399bb43ea114fab70416d49b3cb2539cf8bf658b4b447c4e8597959dc
-
C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exeFilesize
595KB
MD5414f4a3b05028be19e006ae2ba9182b6
SHA12a66efff8a0dfcf8d0ac247940b8f790c3c9d377
SHA256c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec
SHA51282491b4e7876aa3d4306f1fdde6838e93fa123e0b66df8e262275be3fc5b80565475651bcc39765240467b209ca099522afa602ec414ebd9ee5bcaa8dc8a9a44
-
C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exeFilesize
595KB
MD5414f4a3b05028be19e006ae2ba9182b6
SHA12a66efff8a0dfcf8d0ac247940b8f790c3c9d377
SHA256c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec
SHA51282491b4e7876aa3d4306f1fdde6838e93fa123e0b66df8e262275be3fc5b80565475651bcc39765240467b209ca099522afa602ec414ebd9ee5bcaa8dc8a9a44
-
C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exeFilesize
595KB
MD5414f4a3b05028be19e006ae2ba9182b6
SHA12a66efff8a0dfcf8d0ac247940b8f790c3c9d377
SHA256c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec
SHA51282491b4e7876aa3d4306f1fdde6838e93fa123e0b66df8e262275be3fc5b80565475651bcc39765240467b209ca099522afa602ec414ebd9ee5bcaa8dc8a9a44
-
C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exeFilesize
595KB
MD5414f4a3b05028be19e006ae2ba9182b6
SHA12a66efff8a0dfcf8d0ac247940b8f790c3c9d377
SHA256c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec
SHA51282491b4e7876aa3d4306f1fdde6838e93fa123e0b66df8e262275be3fc5b80565475651bcc39765240467b209ca099522afa602ec414ebd9ee5bcaa8dc8a9a44
-
memory/892-148-0x0000000000000000-mapping.dmp
-
memory/1596-152-0x0000000000000000-mapping.dmp
-
memory/2096-142-0x0000000000000000-mapping.dmp
-
memory/2436-149-0x0000000000000000-mapping.dmp
-
memory/3028-136-0x0000000000B90000-0x0000000000C2C000-memory.dmpFilesize
624KB
-
memory/3028-135-0x0000000004C90000-0x0000000004C9A000-memory.dmpFilesize
40KB
-
memory/3028-134-0x0000000004D10000-0x0000000004DA2000-memory.dmpFilesize
584KB
-
memory/3028-132-0x0000000000250000-0x00000000002EC000-memory.dmpFilesize
624KB
-
memory/3028-133-0x0000000005220000-0x00000000057C4000-memory.dmpFilesize
5.6MB
-
memory/3236-137-0x0000000000000000-mapping.dmp
-
memory/3964-160-0x0000000000000000-mapping.dmp
-
memory/4144-154-0x0000000000000000-mapping.dmp
-
memory/4144-158-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4144-161-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4288-143-0x0000000000000000-mapping.dmp
-
memory/4364-145-0x0000000000000000-mapping.dmp
-
memory/4396-159-0x0000000000000000-mapping.dmp
-
memory/4672-146-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4672-144-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4672-141-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4672-139-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4672-138-0x0000000000000000-mapping.dmp